QR codes, GDPR and scan analytics
Counting scans is useful; tracking the people who scan isn’t. Here’s exactly what Scanotte records, what it doesn’t keep, and for how long.
Does a QR code collect personal data?
A static code collects nothing: it holds a link, that’s all. A dynamic code goes through a redirect server, which can log information on each scan; it depends on what the service chooses to keep.
After that, the page that opens may have its own cookies and analytics — that’s the destination site’s responsibility. The difference between the two types is in static vs dynamic.
What exactly does Scanotte record per scan?
Date and time, device type (phone, tablet, computer), operating system (iOS, Android…) and approximate country. For a multi-link page, also which button was clicked.
To estimate the number of people without identifying them, Scanotte computes a truncated fingerprint that changes every day; it never stores the IP address itself and sets no cookie.
| Information | Recorded? |
|---|---|
| Date and time of scan | Yes |
| Device type and system | Yes |
| Approximate country | Yes |
| IP address | No, never kept |
| Cookie on the person’s phone | No |
| Name, e-mail, precise location | No |
How long are scans kept?
Individual scans are deleted after 25 months. Code owners see at most one year of statistics: 30 days on the free plan, 90 days with Starter, one year with Pro and Business.
Pro and Business can export statistics as CSV: one line per scan, with date, time, device, system and country.
Are link previews and bots counted?
No. When a Scanotte link is pasted into WhatsApp, Slack or a social network, those services load a preview: Scanotte doesn’t count it as a scan, nor known bots.
So your numbers reflect real people rather than machines. The same statistics apply to short links.
How does the people estimate work?
For each scan, Scanotte combines a secret key, the day’s date, the IP address and the browser, and keeps only a short fingerprint. Two scans on the same day from the same phone give the same fingerprint; the next day it changes.
The IP address can’t be recovered from that fingerprint, and nobody can be followed from one day to the next. The figure shown is an estimate, not a named count.
Do I need to tell people who scan my code?
With Scanotte, no data that identifies the person is kept at the redirect, and no cookie is set. Your destination page must still meet its own obligations (cookie banner, privacy notice).
This isn’t legal advice: if your activity is sensitive, get your situation checked. For link safety, read are short links safe?.
Frequently asked questions
Does Scanotte sell scan data?
No. Statistics are for the code’s owner; Scanotte keeps no IP and sets no cookie on people who scan.
Is the country precise?
No, it’s a country-level estimate, with no city or location.
Can I see who scanned my code?
No, by design: you see trends, not people.
Do static codes have statistics?
No, they go through no server, so nothing is counted.